EP1345386A2

EP1345386A2 - Method of controlling network access in wireless environment and recording medium therefor

Info

Publication number: EP1345386A2
Application number: EP03250931A
Authority: EP
Inventors: Kyung-Hee Lee
Original assignee: Samsung Electronics Co Ltd
Current assignee: Samsung Electronics Co Ltd
Priority date: 2002-03-16
Filing date: 2003-02-14
Publication date: 2003-09-17
Anticipated expiration: 2023-02-14
Also published as: US20030177350A1; JP3863852B2; EP1345386A3; KR100883648B1; DE60313910T2; CN1206838C; EP1345386B1; JP2003289301A; CN1445963A; KR20030075224A; DE60313910D1

Abstract

A network access controlling method in a wireless environment is provided. In this method, first, an access point completes authenticating a terminal using an MAC-ID. Next, a user inputs a password to a password authentication client. Then, authentication between the password authentication client and an authentication server is performed based on the input password. Thereafter, the terminal accesses an external/internal network (e.g., Internet/Intranet) if the authentication of terminal and the authentication based on the password are approved. Otherwise, the terminal transmits an authentication failure message to the user.

Description

The present invention relates to a method of controlling an access to a network and protecting communication data in a wireless environment, and more particularly, to an access controlling method using a combination of a wireless local area network (hereinafter referred to as WLAN) terminal authentication and a user authentication.
Generally, WLANs are LANs that transmit and receive data over the air without the need for wired connections, using electromagnetic airwaves, radio and infrared, between computers or between a computer and a communication system other than a computer. WLANs have been developed with the recent rapid advancements of Internet services and wireless communication technologies. Because WLANs are easily installed and maintained, they are increasingly used for network connections between buildings or in places where wired network establishments are difficult, such as, large-scale offices or distribution centers. However, WLANs provide poor security compared with wired networks because, theoretically, anybody can access the transmission medium.
In this regard, there are a lot of security services, such as encryption, access control, authentication, non-repudiation, integrity, or the like. All of them are important, but the authentication function is particularly important in respect of providing quality communication services. In a WLAN, proper authentication is first performed before encryption and access control. An authentication with respect to a terminal is necessarily required for public regions or enterprises to provide a WLAN service and charge users. However, in a WLAN system, the security function of a mechanism for authentication using an existing wired equivalent privacy (WEP) does not work against many attacks.
An authentication mechanism in a conventional IEEE802.11b system is classified into an open-system authentication mechanism and a shared-key authentication mechanism. Only the shared-key authentication mechanism performs authentication using an actual key. The open-system authentication mechanism uses an empty character stream opened upon a WLAN card authentication based on an access point. The access point can be connected to a WLAN card device after unconditionally authenticating the card device, even though the card device does not provide accurate authentication information. In the shared-key authentication mechanism, a particular character stream proposed by an access point to a WLAN card in a challenge procedure is coded into a predetermined key in a response procedure through the challenge-response communication using a shared key pre-determined before resuming communications. Then, the coded character stream can be connected to an access point only if it passes the authentication procedure to obtain an authentication to be transmitted from the WLAN card to the access point.
In an IEEE802.11b system, a terminal authenticates itself to an access point using a WEP supplied by a media access control (MAC) layer. In order to authenticate a terminal to an access point by improving an existing authentication mechanism, an IEEE802.11a system can adopt an authentication method using a WEP or a method of defining an authentication protocol in an IEEE802.1X environment identical to or superior to the MAC layer.
An authentication protocol using a WEP is based on a challenge-response method using algorithms for challenge and response procedures. In this method, when a terminal codes a challenge received at an access point using a shared key and a WEP and transmits the code to the access point, the access point decodes the challenge using a previously shared key, thereby authenticating the challenger. However, the authentication protocol using WEP is not safe at all against attacks made on a current WEP algorithm.
The other authentication method proposed by an IEEE802.11a system is to authenticate a terminal on a level equal to or higher than an MAC layer. This authentication method is based on an authentication protocol using an extensible authentication protocol (EAP) in an IEEE802.1X environment, but requires a concrete authentication protocol in order to perform authentication at the same level as or higher one than the MAC layer. The IEEE802.1X environment does not define a concrete authentication protocol.
If the IEEE802.1X environment proposes a concrete authentication protocol, the proposed concrete authentication protocol can be applied to provide a terminal authentication function. However, according to a security service based on the terminal authentication, an unauthorized user that acquired a terminal may access a network although he or she is not the original owner of the terminal. That is, access of users to an enterprise network and a public access service must be controlled.
Next-generation terminals provide accesses to several wireless links. When these accesses are realized within a terminal, authentications for several wireless accesses are required. In order to receive a mutual exchange service of several wireless accesses, a terminal must support authentication for the mutual wireless access. To achieve this, wireless access techniques require an independent mechanism.
In order to authenticate a user, an authentication method using a password is widely used because of the convenience of usage. However, general authentication systems using a password provide a low degree of freedom for a user to select a password. When a password having a size of k bits is selected, and a probability that each of the k bits is 0 or 1 is 0.5, the k-bit password becomes an arbitrary random key. Guessing the random key means making a list of 2^k random password candidates. However, when a user selects a password, random selection is almost impossible, and thus the user is exposed to an off-line password guessing attack.
According to the present invention, there is provided a network access controlling method. In this method, first, an access point completes authenticating a terminal using an MAC-ID. Next, a user inputs a password to a password authentication client. Then, the authentication between the password authentication client and an authentication server is performed based on the input password. Thereafter, the terminal accesses an external/internal network (e.g., Internet/Intranet) if the authentication of terminal and the authentication based on the password are approved. Otherwise, the terminal transmits an authentication failure message to the user.
The present invention provides a network access controlling method having improved security compared with a conventional method, by using both terminal authentication and user authentication in a place requiring authentication as a way of controlling network accesses through a terminal, such as, in a wireless local area network service, and a recording medium storing the software codes of the network access controlling method.
The terminal authentication can be performed in an IEEE802.1X environment.
If the user is the original possessor of the terminal, after the user authentication step and before the password inputting step, the terminal is assigned an Internet Protocol (IP) address and then, it downloads the password authentication client from the authentication server.
In preparatory operations for the password inputting step, first, an arbitrary large prime number n is selected and a primitive element g for a mod n is obtained, so that they serve as information shared by the terminal and the authentication server. Then, the user selects his or her password P to calculate a password verifier v (v=g^h(P)). Next, the user transmits the password verifier value to the authentication server via a safe channel. Here, h( ") denotes a unidirectional hash function.
The present invention relates to a method of allowing a user's access to a network through "user authentication in a broad meaning". The user authentication in a broad meaning can be considered embracing both a method of controlling a user's access to a network by authenticating the terminal used by the user and a method of authenticating the user.
The method of controlling a user's access to a network through terminal authentication is performed in a situation when the user has his or her dedicated terminal such as a mobile phone. Obviously, the terminal of the user has its unique identifier. The network authenticates the terminal using the identifier of the terminal. Accordingly, the user can access the network. In this method, the user can easily access the network without participating in the authentication process. However, the network access control through only terminal authentication causes a security problem. Any person that acquires the terminal can be allowed to access the network through the terminal authentication. That is, an unauthorized user can access the network through other people's terminals. Also, the terminal authentication is based on the identifier of a terminal, such that it depends a lot on the wireless link access technique of the terminal and cannot use other wireless link access techniques.
On the other hand, the user authentication is used to control a user's access to a network by authenticating the user regardless of which terminal the user uses. This user authentication has a disadvantage in that the user must undergo an authentication process. However, the user authentication is important in directly authenticating the user who actually works on a network. In the user authentication, a user can be authenticated regardless of terminals and wireless link access techniques. The present invention is characterized in that user authentication is based on the password known by a user. Also, network access can be easily controlled at a user level.
In other aspects, the invention relates to a method of operating the password authentication client, a method of operating the password authentication server, a computer program for carrying out the methods, the password authentication client and the password authentication server.
The features and advantages of the present invention will become more apparent by describing in detail a preferred embodiment thereof with reference to the attached drawings in which:
FIG. 1 is a block diagram illustrating a network access controlling method according to the present invention; and
FIG. 2 is a flowchart illustrating a network access controlling method according to the present invention.
The present invention will now be described more fully with reference to the accompanying drawings, in which a preferred embodiment of the invention is shown. This invention may, however, be embodied in different forms and should not be construed as limited to the embodiment set forth herein. Rather, the embodiment is provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.
For user authentication, the present invention includes a step of authenticating a terminal possessed by a user and a step of authenticating the user using a password that the user knows. Also, the main bodies of actions, which are a terminal, an access point, and an authentication server existing in a network, are required for the user authentication according to the present invention. FIG. 1 shows the components of a WLAN environment.
Referring to FIG. 1, terminals 100a and 100b have MAC protocol stacks 10a and 10b (e.g., IEEE802.11), respectively, and have frameworks 20a and 20b (e.g., IEEE802.1X), respectively, on the second layer. The MAC protocol stacks 10a and 10b are capable of accessing a wireless link, and the frameworks 20a and 20b enable authentication of a terminal. The terminals 100a and 100b include processors (not shown) for receiving a password from a user and processing the received password. The terminal 100a and an access point 120a constitute a first wireless network, and the terminal 100b and an access point 120b constitute a second wireless network. The terminals 100a and 100b cannot access a host in a wired network without being authenticated by the access points 120a and 120b. The manner in which the access points 120a and 120b process the packets of the terminals 100a and 100b differs depending on where the authentication is performed. For example, in an IEEE802.1X environment, authentication-related packets sent by the terminals 100a and 100b are transmitted to an authentication server 140 in the wired network without undergoing authentication by the access points 120a and 120b.
The access points 120a and 120b are required to access a wired network by wireless, and send an authentication-related packet using a password, which is used in the present invention, to the authentication server 140 in the wired network without any processing. In the IEEE802.1X environment, an access point can simply perform an authentication server function, or can transmit an authentication-related packet to the authentication server 140 while an authentication server in a LAN is assigned to perform a local authentication function.
The authentication server 140 processes authentication messages requested by the terminals 100a and 100b, and stores the session information from the terminals 100a and 100b, the session information with which a user can be charged. That is, the authentication server 140 has the personal information regarding users and records information on the contents of services used by users.
A reference numeral 150 denotes a portal.
Basic operations and parameters required to authenticate a user using a password are as follows.
n: arbitrary large prime number
g: primitive element for mod n
P: user's password
A, B: characters representing a user and an authentication server, respectively
v: a password verifier stored in an authentication server
x_A, x_B: arbitrary private keys of a user terminal and an authentication server, respectively
y_A, y_B: arbitrary public keys of a user terminal and an authentication server, respectively. Here, y_A= g^xA, and y_B= g^xB (where the uses of x_A and y_A are slightly different from those of a private key and a public key, respectively, which are used in a general public key coding system).
c_A: the confounder of a user terminal. A long random value is generally selected as c_A.
h( "): a unidirectional hash function
E_x( "): a symmetric key coding algorithm in which x is used as a private key. Since x can have an arbitrary length, a coding algorithm having a key of variable size, such as Blowfish [Sch93], can be used for security, and an Advanced Encryption Standard (AES) newly established as a block coding algorithm standard by the U.S. National Institute of Standard and Technology can also be used.
K: a session key that is shared by a user and an authentication server and can be used for encryption communications later.
Referring to FIG. 2, a method of controlling user's access to a network, according to the present invention, is composed of two steps. First, an authentication for a terminal is performed. Next, an authentication for the user of the terminal is performed using a password, in step 300. The authentication for the user of a terminal using a password is performed after the following preparatory operations in step 200.

[Step 200 for password registration and preparatory operations]

First of all, the primitive element g for the mod n is obtained by selecting the arbitrary large prime number n. Here, n and g correspond to information shared by a user terminal and an authentication server.
Next, a user selects his or her password P and calculates the password verifier v = g^h(P). As described above, h( ") is a unidirectional hash function.
Thereafter, the user transmits the value of the password verifier v to the authentication server via a safe channel.
A process in which the user acquires a terminal for the first time and gains authentication from the authentication server will now be described. If the user is not the first user in a certain domain, the fourth sub-step in step 300 for network access can be omitted.

[Step 300 for network access]

In the first sub-step, authentication of a terminal is completed using an MAC-ID in an IEEE802.1X environment.
In the second sub-step, an Internet Protocol (IP) address is allocated using a dynamic host configuration protocol (DHCP) server or the like.
In the third sub-step, the address of the authentication server is brought.
In the fourth sub-step, the authentication server downloads a password authentication client.
In the fifth sub-step, a user inputs his or her password to the password authentication client.
In the sixth sub-step, authentication between the password authentication client and the authentication server is completed based on the input password.
In the seventh sub-step, the terminal accesses an external/internal network, such as Internet/Intranet, after authentication is approved.
Hereinafter, the sixth sub-step of step 300 (network access) will be described in greater detail. Step 200 (password registration and preparatory operations) must be performed before the sixth sub-step for authentication.
In the sixth sub-step, firstly, the password authentication client calculates a password verifier v = g^h(P), based on an input password P.
Secondly, the password authentication client produces three random values x_A, c_A, and r.
Thirdly, y_A = g^xA and z₁ = h(y_A, v, c_A) are calculated using the produced random values.
Fourthly, the password authentication client transmits the values z₁, y_A, and r to the authentication server via an access point.
Fifthly, the authentication server stores the received values z₁ and y_A and produces a random value x_B to calculate y_B= g^xB.
Sixthly, the authentication server calculates a session key K =y_A ^xB and h₁ = h(r, v, K), based on the received values y_A and r.
Seventhly, the authentication server transmits a message z₂ =E_v (y_B, h₁), into which the public key y_B of the authentication server and the calculated value h₁ are encoded by a symmetric key encoding system by using a key induced from the password verifier v of the user, to the password authentication client. Here, the length of a required key differs according to a symmetric key encoding system used, but the length of a key required by the password verifier can start from the most significant bit (MSB).
Eighthly, the password authentication client decodes the received encoded message z₂ using the symmetric key encoding system based on a decoding key induced from the password verifier v of the user, and calculates and stores a session key K =y_B ^xA. Thereafter, the password authentication client calculates h ' = h(r, v, K) using the calculated session key and checks whether the calculated value h ' is equal to the received value h₁. If they are not equal, the password authentication client stops a message exchange with the authentication server.
Ninthly, if h ' and h₁ are equal, the password authentication client transmits, to the authentication server, a message z₃ =E_yB (c_A, K), into which K =y_B ^xA and c_A are encoded based on a key induced from the public key y_B of the authentication server. A required key length starting from the MSB of y_B is obtained according to the used symmetric key encoding system.
Tenthly, the authentication server decodes the received z₃ using a key induced from y_B and checks if K =y_B ^xA is equal to K =y_A ^xB. If they are different, the authentication server stops a message exchange with the user authentication client. If K =y_B ^xA is equal to K =y_A ^xB, the authentication server calculates a value h " (=h(y_A, v, c_A)) based on y_A stored in the fifth step and the decoded c_A and checks if h " is equal to z₁. If they are the same, the authentication server transmits a user authentication success message to the password client. If they are different, the authentication server transmits a user authentication failure message to the password client.
After the authentication between the password authentication client and the authentication server is completed, new secrete information enabling encryption communications is shared by the user and the authentication server.
As described above, a user can be authenticated using a password in the WLAN environment. Regardless of several wireless accesses, a user can be authenticated, such that a terminal can be authenticated even when it roams over a variety of networks.
The use of passwords instead of the management using a media access control identifier (MAC-ID) makes a user-level management possible and can provide an inter-technology hand off function. Mutual authentication is possible without a public key infrastructure (PKI). An Internet key exchange (IKE), which is an authentication protocol used in IP security (IPSec), must depend on the PKI or the like in order to authenticate an opposite party. However, the present invention uses a password-dependent authentication method, so that an authentication system can be easily established without the PKI.
According to the present invention, it is possible to check whether a user has the same key as that of an authentication server. Communication data is safe from password attacks worked in a conventional system using a general password. Authentication of a terminal and authentication of a user are independently performed. Shared secret information, with which encoding communications are performed after authentication, is provided. A key known in a session does not include information on a key used in other sessions. Authentication is efficiently performed.
A protocol for mutual authentication and key exchange between a user and an authentication server, according to the present invention, mainly performs a hash function and a symmetric encoding algorithm except when each host performs modular exponentiation one time to achieve a Diffe-Hellman key exchange. Thus, fast authentication and key exchange are realized.

Claims

A network access controlling method in a wireless environment, the method comprising:

(a) an access point completing an authentication for a terminal using an MAC-ID;

(b) accepting user input of a password to a password authentication client;

(c) performing authentication between the password authentication client and an authentication server based on the input password; and

(d) the terminal accessing an external/internal network (e.g., Internet/Intranet) if the authentication in step (a) and the authentication in step (c) are approved, or otherwise, transmitting an authentication failure message to the user.
The network access controlling method of claim 1, wherein step (a) is performed in an IEEE802.1X environment.
The network access controlling method of claim 1 or 2, further comprising the step, between steps (a) and (b), if the user is the original possessor of the terminal, of assigning the terminal an Internet Protocol (IP) address and downloading the password authentication client from the authentication server.
The network access controlling method of any preceding claim, wherein step (b) comprises:

(b-1) selecting an arbitrary large prime number n and obtaining a primitive element g for a mod n, the large prime number n and the primitive element g corresponding to information shared by the terminal and the authentication server;

(b-2) calculating a password verifier v =g^h(P) from the user-selected password P; and

(b-3) transmitting the password verifier value to the authentication server via a safe channel,

wherein h( " ) denotes a unidirectional hash function.
The network access controlling method of any preceding claim, wherein step (c) comprises:

(c-1) the password authentication client calculating the password verifier v = g^h(P) based on the input password P and a value z₁ = h(y_A, v, c_A) wherein x_A is the secret key of the terminal, and c_A the confounder of the terminal;

(c-2) the password authentication client transmitting the calculated value z₁ a public key y_A = g^xA and an arbitrary value r to the authentication server via the access point;

(c-3) the authentication server storing the received values z₁ and y_A and producing a secret key x_B of the authentication server to calculate a public key of the authentication server, y_B= g^xB;

(c-4) the authentication server calculating a session key K =y_A ^xB, and a value h₁ = h(r, v, K), based on the received values y_A and r;

(c-5) the authentication server transmitting a message z₂ =E_v (y_B, h₁), into which a public key y_B of the authentication server and the calculated value h₁ are encoded by a symmetric key encoding system by using a key induced from the password verifier v, to the password authentication client;

(c-6) the password authentication client decoding the received message z₂ using the symmetric key encoding system based on a decoding key induced from the password verifier v of the user, calculating and storing the session key K =y_B ^xA, calculating h ' = h(r, v, K) using the calculated session key, decoding the calculated value h ' , and checking whether the decoded value h ' is equal to the received value h₁;

(c-7) if h ' is not equal to h₁, the password authentication client stopping message exchange with the authentication server, or if h ' and h₁ are equal, the password authentication client transmitting, to the authentication server, a message z₃ =E_yB (c_A, K), into which K =y_B ^xA and c_A are encoded based on a key induced from the public key y_B of the authentication server;

(c-8) the authentication server decoding the received value z₃ using a key induced from y_B and stopping message exchange with the user authentication client if K =y_B ^xA is different from K =y_A ^xB, or otherwise, calculating a value h " =h(y_A, v, c_A) based on the value y_A stored in step (c-4) and the decoded c_A, and checking if h " is equal to z₁; and

(c-9) the authentication server approving a user authentication if h " is equal to z₁, or otherwise, disapproving the user authentication,

wherein E_x( ") denotes a symmetric key encoding algorithm using x as a secret key.
The network access controlling method of claim 5, wherein step (c-1) comprises:

(c-1-a) the password authentication client calculating the password verifier v = g^h(P) based on the input password P and storing the result; and

(c-1-b) the password authentication client producing three random values, i.e., the secret key x_A of the terminal, the confounder c_A of the terminal, and an arbitrary value r, and calculating a public key y_A = g^xA of the terminal and a value z₁ = h(y_A, v, c_A) using the produced random values.
A method of operation of a password authentication client, including:

calculating a password verifier v = g^h(P) based on a user input password P and a value z₁ = h(y_A, v, c_A) wherein x_A is the secret key of the terminal, and c_A the confounder of the terminal;

transmitting the calculated value z₁, a public key y_A = g^xA and an arbitrary value r to an authentication server via the access point, for the authentication server to produce a secret key x_B , a public key , y_B= g^xB, a session key K =y_A ^xB, and a value h₁ = h(r, v, K), based on the received values y_A and r;

accepting a message z₂ =E_v (y_B, h₁) from the authentication server, in which the public key y_B of the authentication server and the calculated value h₁ are encoded by a symmetric key encoding system by using a key induced from the password verifier v, to the password authentication client;

decoding the received message z₂ using the symmetric key encoding system based on a decoding key induced from the password verifier v of the user, calculating and storing the session key K =y_B ^xA, calculating h ' = h(r, v, K) using the calculated session key, decoding the calculated value h ' , and checking whether the decoded value h ' is equal to the received value h₁;

if h' is not equal to h₁, the password authentication client stopping message exchange with the authentication server, or if h ' and h₁ are equal, the password transmitting, to the authentication server, a message z₃ =E_yB (c_A, K), into which K =y_B ^xA and c_A are encoded based on a key induced from the public key y_B of the authentication server;

wherein E_x( ") denotes a symmetric key encoding algorithm using x as a secret key.
A method of operation of a password authentication server, including:

receiving a calculated value z₁, a public key y_A = g^xA and an arbitrary value r from an authentication client where the password verifier v = g^h(P) is based on a user input input password P and z₁ = h(y_A, v, c_A) wherein x_A is the secret key of the terminal, and c_A the confounder of the terminal;

storing the received values z₁ and y_A and producing a secret key x_B of the authentication server to calculate a public key of the authentication server, y_B= g^xB;

calculating a session key K =y_A ^xB, and a value h₁ = h(r, v, K), based on the received values y_A and r;

transmitting to the password authentication client a message z₂ =E_v (y_B, h₁), into which a public key y_B of the authentication server and the calculated value h₁ are encoded by a symmetric key encoding system by using a key induced from the password verifier v, for the password authentication client to decode the received message z₂ using the symmetric key encoding system based on a decoding key induced from the password verifier v of the user, to calculate the session key K =y_B ^xA, to calculate h ' = h(r, v, K) using the calculated session key, to decode the calculated value h ' , and to check whether the decoded value h ' is equal to the received value h₁;

receiving, if h ' and h₁ are equal, from the authentication client, a message z₃ =E_yB (c_A, K), into which K =y_B ^xA and c_A are encoded based on a key induced from the public key y_B of the authentication server;

decoding the received value z₃ using a key induced from y_B and stopping message exchange with the user authentication client if K =y_B ^xA is different from K =y_A ^xB, or otherwise, calculating a value h " =h(y_A, v, c_A) based on the value y_A stored in step (c-4) and the decoded c_A, and checking if h " is equal to z₁; and

approving a user authentication if h " is equal to z₁, or otherwise, disapproving the user authentication,

wherein E_x( ") denotes a symmetric key encoding algorithm using x as a secret key.
A computer readable recording medium that stores a computer program for executing the method of any preceding claim.
An authentication client, comprising:

means for accepting a user password input P;

means for wireless communication with an access point; and

a processor; and

code arranged to cause the processor to carry out the steps of the method of:

calculating a password verifier v = g^h(P) based on a user input password P and a value z₁ = h(y_A, v, c_A) wherein x_A is the secret key of the terminal, and c_A the confounder of the terminal;

transmitting the calculated value z₁, a public key y_A = g^xA and an arbitrary value r to an authentication server via the access point, for the authentication server to produce a secret key x_B , a public key , y_B= g^xB, a session key K =y_A ^xB, and a value h₁ = h(r, v, K), based on the received values y_A and r;

accepting a message z₂ =E_v (y_B, h₁) from the authentication server, in which the public key y_B of the authentication server and the calculated value h₁ are encoded by a symmetric key encoding system by using a key induced from the password verifier v, to the password authentication client;

decoding the received message z₂ using the symmetric key encoding system based on a decoding key induced from the password verifier v of the user, calculating and storing the session key K =y_B ^xA, calculating h ' = h(r, v, K) using the calculated session key, decoding the calculated value h ' , and checking whether the decoded value h ' is equal to the received value h₁;

if h' is not equal to h₁, the password authentication client stopping message exchange with the authentication server, or if h ' and h₁ are equal, the password transmitting, to the authentication server, a message z₃ =E_yB (c_A, K), into which K =y_B ^xA and c_A are encoded based on a key induced from the public key y_B of the authentication server;

wherein E_x( ") denotes a symmetric key encoding algorithm using x as a secret key.